312-49V11 · Question #118
A computer forensics investigator is analyzing a hard disk drive (HDD) that is suspected to contain evidence of criminal activity. The HDD has 20,000 cylinders, 16 heads, and 63 sectors per track…
The correct answer is B. 4 sectors; it may cause inefficiency in space utilization on the disk. Although 1.5KB equals 1536 bytes (which is 3 sectors at 512 bytes/sector), file systems often allocate storage in clusters/blocks larger than a single sector (e.g., 2KB or 4KB blocks). If the allocation unit is 2KB, the file may occupy 4 sectors (2048 bytes), creating slack…
Question
A computer forensics investigator is analyzing a hard disk drive (HDD) that is suspected to contain evidence of criminal activity. The HDD has 20,000 cylinders, 16 heads, and 63 sectors per track, with each sector having 512 bytes. During the analysis, the investigator discovered a file of 1.5KB in size on the disk. How many sectors are allocated for the file, and what could be the consequences of such allocation for the investigation?
Options
- A2 sectors; the file might be fragmented, making it harder to retrieve
- B4 sectors; it may cause inefficiency in space utilization on the disk
- C3 sectors; it may increase the retrieval time due to increased sector overhead
- D3 sectors; the file might be fragmented, making it harder to retrieve
How the community answered
(54 responses)- A4% (2)
- B80% (43)
- C6% (3)
- D11% (6)
Explanation
Although 1.5KB equals 1536 bytes (which is 3 sectors at 512 bytes/sector), file systems often allocate storage in clusters/blocks larger than a single sector (e.g., 2KB or 4KB blocks). If the allocation unit is 2KB, the file may occupy 4 sectors (2048 bytes), creating slack space and inefficient utilization. That slack space can also contain remnants of prior data-relevant for
Topics
Community Discussion
No community discussion yet for this question.